Two very different people search for this. One just ran a security scan, saw “port 80: closed,” and wants to know if something is broken. The other is trying to run a web server and cannot figure out why the outside world cannot reach it. This page handles both, in that order.
If you are not running a web server: closed is correct
Port 80 is the classic web port, so people naturally assume it has to be open on their computer to browse the web. It does not. When you visit a website, your computer connects out to port 80 or 443 on the server. The open port lives on the server’s end. Your router keeps track of the conversation and lets the replies back in on its own.
We heard this worry on our forum for years, usually worded almost exactly the same way: “the test says port 80 is closed on my IP, how do I open it?” The answer never changed. You do not. On a home computer every port should report closed, including 80, and browsing keeps working because browsing is outbound. If you want the fuller story on open, closed, and filtered results, read why port checks fail. And if you are curious what port 80 actually carries these days, our TCP port 80 page covers it, including why most of the web moved to HTTPS on port 443.
So if you are here from a scan result: you are done, and you are in good shape.
If you are hosting something: check from the inside out
When you actually need port 80 reachable, for a web server, a camera interface, or a Let’s Encrypt certificate renewal, test in this order. Each step rules out one layer, starting at the machine itself.
1. Is anything listening? On the server machine, open a browser and load http://localhost. If nothing loads, the web server is not running or not bound to the right address, and no amount of router work will help. On Windows, netstat -ano | findstr :80 in a command prompt shows whether something is listening on 80 and which process ID owns it. A server bound only to 127.0.0.1 will pass the localhost test but be invisible to everyone else; it needs to listen on the machine’s network address too.
2. Can another device on your network reach it? From a second computer or your phone on the same Wi-Fi, load http:// followed by the server’s local address, something like http://192.168.1.50. If this fails, the usual cause is the software firewall on the server. Windows Defender Firewall blocks inbound port 80 until you add an inbound rule for it or for the server program.
3. Can the outside world reach it? First find your public address with what’s my IP. Then take a phone, turn off Wi-Fi so it is on cellular data, and load http:// followed by that address. Testing from inside your own network is the classic trap. Many routers cannot loop traffic back to their own public address, so the site looks down from your desk while being fine from everywhere else. One forum reader fought his setup for days until he tried it “from the real world,” his words, and it had been working all along.
Port 80 shows closed from outside: the usual suspects
If steps 1 and 2 pass but the outside test fails, work through these.
The router is not forwarding port 80. Your router needs a rule sending TCP port 80 to the server’s local address, and that address should be reserved or static so it cannot wander off after a reboot. Full checklist in port forwarding test not working.
Your ISP blocks port 80. Very common on home connections. Providers block inbound 80 (and almost always 25) to keep malware and junk servers off their network. If they do, no router setting will beat it. Options: host on a different port like 8080, use their business tier, or put the site behind a hosting or tunnel service.
You do not have a public address at all. If the WAN address shown inside your router does not match what what’s my IP reports, your provider has you behind carrier-grade NAT, sharing one public address with many customers. Inbound connections cannot reach you, period. A call to the ISP for a real public address, or a tunnel service, are the ways out.
Something else already owns port 80. Only one program can bind a port. On Windows, IIS or the World Wide Web Publishing service may be squatting on 80 without you knowing, and Docker or a second web server can do the same. That netstat command from step 1 names the process ID; Task Manager’s Details tab turns the ID into a name. Back in the day the usual culprit was Skype, which grabbed 80 as a fallback. The players change, the problem does not.
Double NAT. If your ISP’s modem routes and your own router routes behind it, a forward on one box dies at the other. Either bridge the modem or forward the port on both.
A note on 80 versus 443
Most public websites now answer on port 443 with HTTPS and keep 80 open only to redirect people to the secure version. If you are setting up anything new, plan for 443 with a certificate and treat 80 as the doorway, not the destination. One thing still depends on plain 80: the common Let’s Encrypt renewal method makes a quick visit over HTTP, so if certificates suddenly stop renewing, an ISP block or a lost forward on port 80 is the first thing to check.
Whatever you open, open it on purpose. Check the port in our port database, keep the list short, and verify from the outside after every change. Our firewall test page shows what else your connection is telling the world.